AWS Certified Cloud Practitioner
AWS shared responsibility model explained for Cloud Practitioner
AWS is responsible for security of the cloud: the hardware, software, networking and facilities that run AWS services. The customer is responsible for security in the cloud: its data, its permissions and whatever it configures. How much the customer must do depends on which AWS services it chooses.
Security of the cloud vs security in the cloud
AWS protects the infrastructure that runs all AWS services. AWS operates, manages and controls everything from the host operating system and virtualization layer down to the physical security of the facilities.
The customer protects what it puts in the cloud and how it sets it up. That always includes managing its data (including encryption options), classifying its assets, and using IAM to give the right permissions.
The split changes with the service
AWS says customer responsibility is determined by the AWS services a customer selects. The more of the stack AWS runs for you, the less you configure.
Amazon EC2 is at the customer-heavy end. A customer running an EC2 instance manages the guest operating system, including updates and security patches, any application software it installs, and the configuration of the security group firewall on each instance.
Amazon S3 and Amazon DynamoDB are abstracted services. AWS operates the infrastructure layer, and customers access the endpoints to store and retrieve data. The customer still manages its data, encryption options and IAM permissions.
Inherited, shared and customer-specific controls
Inherited controls are ones the customer fully inherits from AWS. AWS's example is physical and environmental controls.
Shared controls apply to both sides, each in its own context. Patch management: AWS patches flaws within its infrastructure, and customers patch their guest OS and applications. Configuration management: AWS maintains the configuration of its infrastructure devices, and customers configure their own guest operating systems, databases and applications. Awareness and training: AWS trains AWS employees, and customers train their own.
Customer-specific controls are solely the customer's responsibility. AWS's example is service and communications protection, or zone security, where a customer may need to route or zone data within specific security environments.
Where the exam catches people
- Believing AWS patches the guest operating system on EC2: the customer patches the guest OS and its applications; AWS patches the host OS and its own infrastructure.
- Believing the split is the same for every service: it depends on the services chosen, so EC2 leaves the customer far more to configure than Amazon S3 or DynamoDB.
- Believing patch management is an inherited control: it is shared, and the inherited example AWS gives is physical and environmental controls.
- Believing AWS is responsible for a customer's data on a managed service: the customer always manages its data, encryption options and IAM permissions.
- Believing security groups are configured by AWS: the customer configures the security group firewall on each EC2 instance.